CVE-2026-80779: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80779 Overview

CVE-2026-80779 is an out-of-bounds access vulnerability in the Linux kernel's net/ionic network driver. The flaw affects the dedicated hardware timestamp receive queue (hwstamp RXQ), which is allocated with a queue index equal to lif->ionic->nrxqs_per_lif. The txqcqs array only contains regular queue pairs, so indexing into it with the hwstamp RX queue index reads one entry past the array bounds. The kernel then writes through the derived pointer while setting rxq->partner, producing an out-of-bounds read followed by an out-of-bounds write in kernel memory.

Critical Impact
The defect allows memory corruption within kernel context on systems using Pensando/AMD ionic network adapters with hardware timestamping enabled, potentially leading to kernel instability or exploitable memory corruption.

Affected Products

Linux kernel builds including the net/ionic driver with hardware timestamp RX queue support
Stable kernel branches prior to the fixes committed in 39fc615, 881a805, d92255b, ea081b4, and f386804
Systems using Pensando/AMD ionic Ethernet adapters with PTP hardware timestamping

Discovery Timeline

2026-09-04 - CVE-2026-80779 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80779

Vulnerability Analysis

The net/ionic driver in the Linux kernel allocates a dedicated RX queue for hardware timestamping. This queue receives an index of lif->ionic->nrxqs_per_lif, which sits immediately past the last valid regular queue pair. During RX/TX partner linking, the driver uses this index to look up a transmit partner in the txqcqs[] array. That array is only sized for regular queue pairs, so the lookup dereferences memory one entry beyond the allocation.

The subsequent assignment to rxq->partner writes through the derived pointer, corrupting kernel memory adjacent to the txqcqs array. On systems that use the XDP_TX code path, the driver then follows the invalid partner pointer during packet transmission, compounding the fault.

The upstream fix restricts RX/TX partner linking to normal queue-pair indexes, leaves the hwstamp RX queue unpaired, and makes the XDP_TX path abort cleanly when an RX queue has no TX partner. See kernel commits 39fc615, 881a805, d92255b, ea081b4, and f386804.

Root Cause

The root cause is an indexing mismatch between two parallel arrays. The hwstamp RX queue is assigned an index at the boundary of nrxqs_per_lif, but the txqcqs transmit array only covers regular queue pairs. Reusing the RX index to select a TX partner produces an out-of-bounds read, and the subsequent partner assignment yields an out-of-bounds write.

Attack Vector

Exploitation requires local kernel-mode conditions triggered during driver initialization when a hwstamp RX queue is provisioned. The out-of-bounds read/write occurs in kernel context, so successful triggering affects kernel memory adjacent to the queue arrays. No verified public proof-of-concept is available at this time, and no remote network-triggered exploitation vector is documented. Reliable exploitation would depend on kernel heap layout at driver bring-up.

Detection Methods for CVE-2026-80779

Indicators of Compromise

Kernel oops, panic, or KASAN reports referencing ionic_lif_alloc, ionic_qcq_alloc, or partner-linking code paths
Unexpected NIC link resets or driver reload events on hosts using ionic adapters with PTP/hardware timestamping enabled
Slab-out-of-bounds reports naming the txqcqs array in kernel logs

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to surface the out-of-bounds access at driver initialization
Inventory hosts running ionic driver builds without the referenced stable commits using modinfo ionic and uname -r
Correlate kernel ring-buffer messages from dmesg with hardware timestamping activation events

Monitoring Recommendations

Forward kernel logs from Linux hosts running ionic NICs into a centralized log platform for anomaly review
Alert on repeated NIC subsystem crashes, driver reloads, or queue allocation failures on affected hardware
Track kernel package versions across the fleet to identify systems that have not received the backported fix

How to Mitigate CVE-2026-80779

Immediate Actions Required

Update to a Linux kernel release that includes one of the referenced stable commits (39fc615, 881a805, d92255b, ea081b4, or f386804)
Prioritize patching hosts with ionic adapters where hardware timestamping (PTP) is enabled
Reboot patched systems to load the corrected ionic driver into the running kernel

Patch Information

The fix restricts RX/TX partner linking to normal queue-pair indexes, leaves the hwstamp RX queue unpaired, and adds a safety check in the XDP_TX path to abort when an RX queue has no TX partner. Apply the vendor kernel update that incorporates the upstream stable commits listed above, or rebuild from source using a stable branch that includes them.

Workarounds

Disable hardware timestamping on affected ionic interfaces where operationally acceptable, removing the code path that provisions the hwstamp RX queue
Avoid enabling XDP_TX on ionic interfaces on unpatched kernels to reduce the likelihood of following a corrupted partner pointer
Restrict local privileged access on affected hosts until patched kernels are deployed

bash

# Verify running kernel and ionic driver version
uname -r
modinfo ionic | grep -E '^(version|srcversion|filename)'

# Check whether hardware timestamping is enabled on an ionic interface
ethtool -T <ifname>

# Disable hardware timestamping as a temporary workaround
hwstamp_ctl -i <ifname> -r 0 -t 0